refactor: share workflow contracts across harnesses

[tbrownio]

Summary

What: Centralizes workflow semantics, delegated-role instructions, and
workflow-owned formats/assets into shared references, with thin Claude and
Codex adapters around them. It also moves Codex workflow discovery to
.agents/skills, adds project custom-agent definitions under .codex/agents,
removes obsolete leaf-role skills, and makes consumer/user sync union-safe.
A follow-up hardening pass makes every Claude agent shim fail closed on a
missing role contract and adds a Contents section to the two workflow
contracts past ~300 lines.

Why: Workflow and role behavior was duplicated across harness-specific
files, allowing fixes to drift and exposing internal Codex leaf roles as
user-facing skills. The hardening pass addresses the two recurring caveats of
the pointer-based (progressive-disclosure) pattern documented in Anthropic's
skill-authoring guidance and practitioner reports: an agent that improvises
when its referenced contract is unreachable, and partial reads of long
referenced files (Anthropic recommends a table of contents past ~300 lines).
The Codex TOMLs already failed closed; the Claude shims now match.

How: Shared contracts now live under references/workflows/ and
references/agents/; adapters retain only invocation, dispatch, and lifecycle
behavior. A repository check validates pointers, metadata, discovery,
repo-agnostic content, legacy tombstones, idempotence, and preservation of
consumer-local content. All six Claude agent shims append the same
fail-closed sentence used by the Codex agent TOMLs; do.md and
excalidraw-pr-diagrams.md gain ## Contents sections.

Done means: Claude and interactive Codex workflows execute the same shared
semantic contracts, both discovery layouts work, personal union-space entries
survive repeated syncs, and the existing Claude-rooted daemon remains
regression-green.

Visual overview

Visual overview: none — this is a repository-only Markdown, discovery, and sync
refactor with no rendered user interface.

Verification

• Socratic approach gate: passed on round 2.
• Dual code review: low- and high-effort lanes approved the narrowed candidate
  on pass 2 with zero Must Fix or Should Fix findings.
• bash scripts/check-skill-contracts.sh — passed, including disposable
  consumer/user sync, idempotence, union-space preservation, discovery, and
  normalized-root refusal. Re-run after the fail-closed/TOC hardening commit:
  passed.
• bash scripts/check-dispatch-survival.sh — passed.
• shellcheck scripts/sync.sh scripts/sync-user.sh scripts/check-skill-contracts.sh
  — passed.
• pnpm typecheck && pnpm build && pnpm test from daemon/ — passed:
  325 tests passed, 1 integration test skipped.
• git diff --check — passed.
• Staged secret-pattern and scratch-file scans — passed.

Residual risks

• Codex custom-agent definitions are schema- and discovery-validated and are
  used by interactive Codex environments, but this PR does not qualify
  unattended Codex CLI child spawning.
• The production daemon remains Claude-rooted. This PR intentionally contains
  no native Codex daemon gate, version watcher, provisioning, migration, or
  activation changes.

🤖 Generated with Claude Code